Sanity check region offset range on headerLoad()

- Fixes the  first case crash of RhBug:741606 / CVE-2011-3378 where
  immutable region offset is way out of bounds.

diff --git a/lib/header.c b/lib/header.c
index 284be09..c771967 100644 (file)
--- a/lib/header.c
+++ b/lib/header.c
@@ -836,7 +836,7 @@ Header headerLoad(void * uh)
 
        {   int off = ntohl(pe->offset);
 
-           if (hdrchkData(off))
+           if (hdrchkData(off) || hdrchkRange(dl, off))
                goto errxit;
            if (off) {
                size_t nb = REGION_TAG_COUNT;